Back to Blog
Tutorial

How to Password Protect Shared Files in FileGrab

FileGrab Team 12 min read

Sharing files publicly can be risky, especially when you need to share a link through email, Slack, or other channels where it might be intercepted. FileGrab’s password protection feature adds a crucial security layer - even if someone gets your link, they can’t access your files without the password.

In this comprehensive guide, you’ll learn how to set up password-protected links, share them securely, and understand when password protection is the right choice for your files.

What is Password Protection in FileGrab?

Password protection adds an access control layer to your shared links. When someone tries to open a password-protected link, they must enter the correct password before they can see or download any files.

Here’s how FileGrab implements password protection securely:

  • PBKDF2-SHA256 hashing - Passwords are hashed with 100,000 iterations, making brute-force attacks extremely difficult
  • Server-side verification - Passwords are verified on FileGrab’s servers, not in client-side JavaScript
  • No password storage in plain text - Only the secure hash is stored
  • Owner bypass - Link owners never need to enter the password on their own links
  • Per-link passwords - Each link can have a unique password

When Should You Use Password Protection?

Password protection is ideal for:

  • Sharing files through insecure channels (email, SMS, public Slack channels)
  • Distributing files to a group who should all have access
  • Adding a simple security layer without encryption complexity
  • Sharing with non-technical recipients who might struggle with encrypted links
  • Temporary access control for files you might want to share more widely later

When NOT to use password protection alone:

  • Highly sensitive documents (medical records, financial data, legal files) - use encryption instead
  • Situations where you need guaranteed security - passwords can be weak or shared
  • When you need proof that files weren’t accessed by servers - use end-to-end encryption

Password Protection vs End-to-End Encryption

FileGrab offers both password protection and end-to-end encryption. Here’s the key difference:

Password Protection:

  • Files are stored normally on FileGrab’s servers
  • Password controls who can access the link
  • Simpler for recipients (just enter a password)
  • FileGrab’s servers can see your files

End-to-End Encryption:

  • Files are encrypted before upload
  • Encryption key never sent to servers
  • FileGrab’s servers cannot decrypt your files
  • More secure but requires sharing the complete URL with #key

For maximum security, you can use both together - encrypt your files and add a password to the encrypted link.

Setting Up Password Protection

Step 1: Upgrade to FileGrab Pro

Password protection is a premium feature available only to FileGrab Pro subscribers.

[SCREENSHOT: Upgrade modal showing Pro features including password protection]

If you’re on the free plan:

  1. Click your avatar in the top-right corner
  2. Select “Upgrade to Pro”
  3. Choose monthly ($10/mo) or annual ($100/yr) billing
  4. Complete the checkout process

You can add password protection to:

  • Brand new links (create via “New Link” in user menu)
  • Existing links you own
  • Encrypted links (for double protection)

[SCREENSHOT: Link page showing the settings gear icon]

For this tutorial, let’s use an existing link:

  1. Go to “My Links” from the user menu
  2. Click on any of your links to open it
  3. Look for the settings gear icon in the link bar

Step 3: Enable Password Protection

[SCREENSHOT: Link settings modal with password protection toggle and password input field]

Once you’re on your link page:

  1. Click the gear icon in the link bar
  2. Find the “Password Protection” toggle
  3. Switch it to ON
  4. Enter your desired password
  5. Click “Save Changes”

Password requirements:

  • Minimum 6 characters (recommended: 12+ characters)
  • No maximum length
  • Can include letters, numbers, and special characters
  • Case-sensitive

After saving, you’ll see a key icon badge appear in your link bar, indicating the link is password-protected.

[SCREENSHOT: Link bar showing the password-protected key icon badge]

Step 4: Test the Password Protection

Before sharing your link, test it yourself to ensure the password works:

  1. Open a new incognito/private browser window
  2. Paste your link URL
  3. You should see the password challenge modal

[SCREENSHOT: Password challenge modal with password input field and submit button]

Enter your password and click “Unlock” - you should gain access to the files.

Note: When you’re logged in as the link owner, you won’t see the password challenge. FileGrab automatically recognizes you as the owner and shows a password visibility toggle instead.

[SCREENSHOT: Link owner’s view showing password show/hide toggle in settings]

The security of password protection depends heavily on how you share both the link and the password. Here are the best practices:

Method 1: Separate Channels (Most Secure)

Send the link and password through different communication channels:

Example:

  1. Send the link via email
  2. Send the password via SMS or phone call
  3. Or send the link in Slack and the password in a direct message

This ensures that if one channel is compromised, the attacker still doesn’t have both pieces of information.

Method 2: Secure Messaging Apps

If you’re using encrypted messaging apps like Signal or WhatsApp:

  1. Send the link first
  2. Wait for confirmation that they received it
  3. Then send the password in a follow-up message

This gives you a chance to verify the recipient before sharing the password.

Method 3: In-Person or Phone

For highly sensitive files:

  1. Share the link via email or message
  2. Call the recipient and verbally share the password
  3. Don’t send the password in any written form

Method 4: Password Hints (Less Secure)

If you need to share with a group who all know certain information:

  1. Set a password based on shared knowledge
  2. Include a hint in your message: “Password is our project code + current year”

This only works if you’re confident that only authorized people know the hint answer.

Viewing Your Password

As the link owner, you can always view and change your password:

[SCREENSHOT: Link settings modal showing password field with show/hide button]

  1. Click the gear icon on your link
  2. Look at the “Password Protection” section
  3. Click the eye icon to reveal the password
  4. Copy it if needed

Changing the Password

To change your link’s password:

  1. Open the link settings (gear icon)
  2. Clear the current password field
  3. Enter a new password
  4. Click “Save Changes”

All future visitors will need the new password. Anyone who previously accessed the link will need to enter the new password on their next visit.

Removing Password Protection

To remove password protection entirely:

  1. Open link settings
  2. Toggle “Password Protection” to OFF
  3. Click “Save Changes”

The link immediately becomes publicly accessible to anyone with the URL.

Recipient Experience

First-Time Access

When someone accesses your password-protected link for the first time:

[SCREENSHOT: Password challenge modal from recipient’s perspective]

  1. They see a modal with a password input field
  2. They enter the password you shared
  3. Click “Unlock” or press Enter
  4. If correct, they gain full access to the files
  5. If incorrect, they see an error and can try again

After Successful Authentication

Once a recipient enters the correct password:

  • They can view all files on the link
  • They can download any file
  • They can upload files (if collaboration is enabled)
  • Their browser remembers the password for this session

Important: The password is stored in the browser’s session storage, which clears when they close the tab. They’ll need to enter it again if they revisit the link later.

Failed Password Attempts

FileGrab doesn’t lock accounts after failed password attempts (unlike login systems), because:

  • Links are meant to be shared with multiple people
  • There’s no account associated with accessing a link
  • Rate limiting prevents brute-force attacks

However, FileGrab does implement rate limiting: too many failed attempts from the same IP address will temporarily block that IP from trying again.

Advanced Password Strategies

Strong Password Generation

Don’t use simple passwords like “password123” or “filegrab”. Here are better approaches:

Passphrase Method:

  • Combine 4-5 random words: “correct-horse-battery-staple”
  • Easy to remember, hard to crack
  • Can be verbally shared without spelling

Random String Method:

  • Use a password manager to generate: “x9K$mP2@qR5vN7yT”
  • More secure but harder to communicate
  • Best when sharing digitally

Shared Secret Method:

  • Base it on information only your recipients know
  • Example: “ProjectName2024” for a team project
  • Include special characters: “ProjectName2024!”

Rotating Passwords

For long-lived links shared with groups, consider rotating passwords periodically:

  1. Every 30 days, generate a new password
  2. Update the link’s password in settings
  3. Notify authorized users of the new password
  4. Document the rotation schedule

This limits the damage if a password is accidentally leaked.

Pro users can set custom expiry dates. Combine this with password protection:

  1. Set a password when creating the link
  2. Set expiry to 7 days (or appropriate timeframe)
  3. Share with recipients
  4. After expiry, the password becomes irrelevant

This provides automatic cleanup for temporary file sharing.

Troubleshooting Common Issues

”Incorrect Password” Even Though It’s Right

Common causes:

  • Extra spaces: Copied password might have trailing spaces. Try typing it manually.
  • Case sensitivity: “Password” and “password” are different. Verify capitalization.
  • Password was changed: The link owner might have updated the password. Ask for the current one.
  • Wrong link: Verify you’re accessing the correct link URL.

Recipients Can’t Access After Password Entry

If the password is accepted but files don’t appear:

  1. Check browser console for errors (F12 > Console tab)
  2. Try a different browser (Chrome, Firefox, Safari, Edge)
  3. Disable browser extensions that might interfere
  4. Clear browser cache and try again

Password Not Saving in Settings

If you enter a password but it doesn’t save:

  1. Verify you clicked “Save Changes” (not just closing the modal)
  2. Check that you’re the link owner (only owners can add passwords)
  3. Verify your Pro subscription is active
  4. Try refreshing the page and setting it again

Owner Can’t See Password Challenge

This is normal behavior - link owners automatically bypass password protection on their own links. To test the password:

  1. Open an incognito/private browser window
  2. Access the link there (where you’re not logged in)
  3. You’ll see the password challenge like recipients do

Security Considerations

Password Strength Matters

A password-protected link is only as secure as the password itself. Weak passwords can be guessed:

  • Weak: “123456”, “password”, “qwerty”
  • Medium: “FileGrab2024”, “MyFiles123”
  • Strong: “xK9$mP2@qR5vN”, “correct-horse-battery-staple”

Use strong passwords for sensitive files.

Passwords Can Be Shared

Once you share a password, you lose control over who has it:

  • Recipients can share it with others
  • It might be written down insecurely
  • It could be intercepted in transit

For files requiring strict access control, consider these alternatives:

  • Create individual links for each recipient
  • Use FileGrab’s end-to-end encryption
  • Combine password protection with link expiry

Server-Side Storage

Unlike end-to-end encryption, password-protected files are stored normally on FileGrab’s servers. FileGrab can technically access your files (though it never does without legal requirement).

For files you need to keep from server access, use encrypted links instead.

You can combine password protection with collaborative links (where both parties can upload):

[SCREENSHOT: Link settings showing both collaboration and password protection enabled]

  1. Enable “Allow Collaboration” in link settings
  2. Enable “Password Protection” with a password
  3. Share the link and password with collaborators

Use case: Collecting files from a group:

  • Create a collaborative, password-protected link
  • Share with your team or clients
  • Only people with the password can upload
  • Prevents random people from uploading if the link leaks

Real-World Use Cases

Client File Delivery

You’re a designer sending finals to a client:

  1. Upload designs to a FileGrab link
  2. Add password protection
  3. Email the link, text the password
  4. Client enters password and downloads files
  5. Delete the link after confirmation

Team Document Sharing

Sharing company documents with your team:

  1. Create a password-protected link
  2. Use the team’s shared password (known to all members)
  3. Share in team Slack channel
  4. Set expiry for end of project
  5. Team members access without individual authentication

Event File Distribution

Distributing photos after an event:

  1. Upload all event photos
  2. Password protect the link
  3. Password is the event name + year
  4. Share link in event group chat
  5. Attendees can access, others cannot

Start Protecting Your Files Today

Password protection is one of the simplest ways to add security to your shared files. It takes seconds to set up and provides meaningful protection against unauthorized access.

Ready to secure your file sharing? Upgrade to FileGrab Pro and start creating password-protected links today.

FileGrab Pro includes:

  • Password protection with PBKDF2-SHA256 hashing
  • 10GB storage and 2GB file uploads
  • Forever links with custom expiry
  • End-to-end encryption and collaborative links
  • No ads, ever

Upgrade now and share files with confidence.

#password#security#protection#tutorial

Ready to try FileGrab?

Share files instantly with our link-first approach. No signup required for basic sharing.

Start Sharing Files